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ow" 4 Key messages 


DIGITALEUROPE strongly believes in the potential of GAIA-X to become a game- 
changing initiative to support innovative data exchanges and cloud and edge 
uptake in Europe. Pursuing our commitment to the GAIA-X project, after applying 
as day-1 member, we now propose recommendations to improve GAIA-X’s 
operations and deliverables: 


>> Consolidate the governance structure. Further work is still needed to 
develop and enhance internal rules and procedures, particularly to best 
integrate newer members to the GAIA-X community. 


>> Consult the wider community. Given the expected impact of GAIA-X, 
which will likely exceed the scope of its initial membership, any review and 
approval processes of major deliverables should be as inclusive as 
possible, ensure sufficient discussion among interested parties, to achieve 
maximum consensus. 


>> Bring added value and flexibility. GAIA-X’s policy rules and architecture 
of standards (PRAAS) should only focus on principles needed to create the 
ecosystem and allow for different means of compliance while ensuring 
transparency on any variations and providing federated services respecting 
shared values and global standards. 
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Introduction 


DIGITALEUROPE is a strong supporter of the GAIA-X project, more particularly 
its overarching goal to develop and foster an innovative and trusted data-driven 
ecosystem in Europe. We are convinced that GAIA-X can support innovation in 
Europe by enabling a decentralised infrastructure and architecture based on 
shared values, which would encourage data sharing and cloud and edge take-up 
by European companies, while advancing EU policy and standardisation 
discussions. DIGITALEUROPE has therefore decided to become a GAIA-X day-1 
member and wishes to constructively contribute to this important European project. 


Now that the GAIA-X AISBL has been formally established, DIGITALEUROPE 
considers it important to formulate, on behalf of its members, a set of views, 
questions and recommendations to enhance the operations of GAIA-X. Achieving 
an optimal functioning organisation is essential for GAIA-X to succeed in its 
ambitions to unlock Europe’s digital and data potential. Our observations can be 
broken down into 4 different aspects: 


>> General observations on governance, transparency and processes of 
GAIA-X. 


>> Observations on the process of defining policy rules and architecture of 
standards (PRAAS). 


>> Observations on PRAAS content. 


>> Observations on the governance and implementation of data spaces. 
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General remarks on governance, transparency 
& process 


To help ensure that GAIA-X effectively accomplishes its overall objectives, we 
believe that it is of key importance for GAIA-X to establish a credible, transparent, 
fair and efficient governance structure with appropriate and adequate safeguards. 
We recommend to fully implement such governance framework before taking 
substantive and duly considered decisions on behalf of the broader community of 
GAIA-X members. 


Therefore, it is crucial that GAIA-X continues its work in improving its governance 
structure, including its internal rules, policies and procedures, to make them more 
transparent, inclusive and fair. Concretely, now that the GAIA-X high-level “Articles 
of Association” have come into effect, each GAIA-X governance body (including 
the Board of Directors and each of the technical and policy committees and 
working groups), should operate under clear and comprehensive due process- 
based procedures and policies governing its work and decision-making 
processes. To ensure that decisions taken by those bodies are fair, transparent, 
trustworthy, effective, proportionate, non-discriminatory, and achieve maximum 
consensus, such procedures and policies should include details on how proposals 
are made, documented, discussed (including comments from impacted 
stakeholders who may not have a seat on the specific committee), finalised and 
approved. 


We believe that the above proposals would provide more clarity on how GAIA-X 
day-1 members (which are not expected to be formally approved as “members” 
until mid-March at the earliest) and subsequent members can have a meaningful 
voice in the activities, decisions and outputs of GAIA-X. 


Given its bold and ambitious mission, GAIA-X will be successful if it is able to 
represent its membership and community. This is a particularly important goal to 
work in the current transitional phase and towards formation of the AISBL’s 
secretariat, which should pave the way for an inclusive and effective sustainable 
governance. 


Several members of DIGITALEUROPE have found it difficult to engage in GAIA-X 
activities. It is of utmost importance that GAIA-X establishes a single point of 
contact for its members, and that GAIA-X uses a consistent set of contact points, 
such as those stated in the letters of intent to become members. Building enough 
capacity and resources in the GAIA-X association’s secretariat will be key to 
successfully support the onboarding of its many new members. 


We ask GAIA-X to urgently develop its by-laws, IPR policy and other governance 
documents (such as Committee rules of procedure, public comment policy, 
competition policy, written records policy, appeal processes, etc.) covering the 
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different GAIA-X activities, with the opportunity for review and feedback. The 
absence of such procedures and rules makes it more difficult for stakeholders like 
DIGITALEUROPE and several of its members to potentially engage — as they may 
be committing to a project whose rules they may ultimately find insufficient and/or 
disagree with substantively. 


The establishment of a clear IPR policy (that addresses, among other things, the 
requirements regarding the disclosure of possibly implicated IPR of all types and 
establishing required disclosure obligations and licensing commitments) would 
notably minimise the risk that GAIA-X deliverables would include stakeholders’ 
proprietary IPR without any up-front understanding or agreement as to the 
parameters of any related licensing programme. Without such disclosure and 
related licensing commitment, the IPR holder arguably can seek to exploit its IPR 
against the GAIA-X stakeholder community in ways that could undermine the 
GAIA-X project and/or unfairly or commercially benefit individual stakeholders, 
which goes against the GAIA-X principles of openness and transparency. 


Observations on the PRAAS process 


DIGITALEUROPE welcomes the objective of the PRAAS (Policy Rules and 
Architecture of Standards) to build a coherent policy framework within the GAIA-X 
ecosystem, to ensure the secure exchange and usage of data based on European 
values. The process of identifying the appropriate norms, recommendations and 
standards is of utmost importance to the success of GAIA-X and hence extremely 
relevant for its members. 


At the same time, the PRAAS likely will identify certain requirements for a broad 
range of GAIA-X stakeholders that could impact market access. Therefore, 
DIGITALEUROPE believes that work on the revision of the PRAAS should be 
accompanied by in-depth internal consultation and defined feedback processes, 
allowing all GAIA-X members to constructively contribute to this milestone project. 
Ultimately, this will ensure that this set of rules is proportionate, non-discriminatory, 
and reflects a broad and workable consensus of both cloud users and service 
providers, and other stakeholders. 


As has been recognised by Board Chair of GAIA-X Hubert Tardieu during a 
DIGITALEUROPE event on 3 February', standard-setting processes can take 
several years. In this specific context, GAIA-X seeks to adopt the PRAAS in a 
much faster pace to build on the momentum of its creation. While we understand 
the ambitions to make quick progress, DIGITALEUROPE supports a thorough 
process leading to a high-quality and consensus-based outcome that will further 
enable GAIA-X’s overall effectiveness and success. 


1 Speaking at DIGITALEUROPE’s ‘Masters of Digital’ event. Recording: youtu.be/9NzgwnT9ZUM 
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Many DIGITALEUROPE members have intensely discussed the first draft version 
of the PRAAS (V1.1) published on 4 June 2020? and submitted concrete feedback 
for its future development during the Autumn 2020, as part of the formal GAIA-X 
consultation process*. To date, the comments sent have not been openly 
addressed and the exact process by which these comments are to be considered 
and consolidated into a PRAAS V2.0 has not yet been defined. 


Specifically, part of the feedback from the community identified fundamental 
inconsistencies and raised significant questions regarding the PRAAS draft 
version 1.1. Therefore, for GAIA-X to succeed, we believe that the comments from 
the community must be addressed prior to any adoption of the PRAAS by the 
AISBL. This review of comments should be open, transparent, and consensus- 
based in the interest of establishing a consensual foundation for the GAIA-X policy 
rules in the short and medium terms and, in the long term, an appropriate basis for 
the work of the European Commission for its future Cloud Rulebook. We believe 
that upholding the processes outlined above would ensure adequate consultation 
and would support continued successful project design and stakeholder 
engagement within GAIA-X. 


Members also wish to actively participate in the GAIA-X governance groups that 
are currently working on the next release of the Policy Rules, of the Technical 
Architecture, and of the Architecture of Standards documents to help shaping and 
finalising PRAAS V2.0. Unfortunately, this has been challenging in the absence of 
clear processes for onboarding, and without real meaningful involvement of the 
broad group of day-1 members. It is important to improve the current working 
arrangements and to determine clear, approved processes and good governance 
rules, to ensure transparency, openness and inclusiveness (especially of all 
impacted stakeholders). 


Thus, we strongly recommend that a second open and meaningful consultation 
process takes place before the next release of the PRAAS is formally adopted. 


Additionally, it is important that version 2 of the PRAAS is not considered adopted 
without a formal approval process being held in the GAIA-X AISBL. Given the 
importance of the document for the development of the GAIA-X ecosystem, we 
believe that adoption of the PRAAS would have to be carried at both Board of 
Directors and General Assembly levels. 


Regarding the future development of PRAAS, DIGITALEUROPE recommends 
clarity about the frequency of the review and evaluation of the document. To that 


2 GAIA-X, PRAAS V1.1, https:/Avww.data-infrastructure.eu/GAIAX/Redaktion/EN/Publications/gaia- 
x-policy-rules-and-architecture-of-standards.html 


3 We understand that around 800 comments were received by the GAIA-X founders. 
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end, a regular, inclusive, consensus-based and transparent feedback and review 
process should be introduced. 


Observations on PRAAS content 


The PRAAS (Policy Rules and Architecture of Standards) is currently conceived 
as a long list of detailed requirements contained in a spreadsheet. We believe that 
in order to be easy to use and efficiently implemented, the PRAAS should go 
beyond being a compilation of a vast number of rules, and rather seek to focus on 
the rules and standards deemed most crucial. The ultimate goal of such norms 
should always be to stimulate secure and innovative data-driven models and cloud 
usage. Thus, a clearer set of requirements and explanations about the rationale 
used for choosing the rules should be included in the PRAAS document, for 
instance in the form of a summary outlining the essence of these rules and the 
principles used to design them. 


As stated by GAIA-X, the policy rules and the architecture of standards are closely 
connected. Therefore, we suggest to ensure close coordination between these two 
workstreams. 


The distinction between mandatory policies and optional standards should be 
clarified, including by providing a concrete and precise definition of “mandatory”. 
The PRAAS document must clearly demonstrate when compliance with GAIA-X 
requires one specific policy and when it can be achieved by a selection from 
various existing standards. We recommend differentiating between high-level 
requirements and specific standards that can be used to ensure compliance with 
the high-level requirements. In addition, GAIA-X could allow alternative 
approaches to meet requirements (and avoid requiring the use of or adherence to 
an arguably proprietary solution) to the fullest extent possible. The use of 
alternatives should appear in service providers’ self-description and GAIA-X 
catalogue features, for users to be informed about key aspects of each service 
proposed. 


DIGITALEUROPE underlines that the PRAAS should not selectively refer to 
existing legal acts or provisions. Compliance with applicable legal requirements is 
an obvious pre-requisite and does not depend on whether the rules are quoted in 
the PRAAS or not. Rather, referring to certain legal provisions can give the 
impression that some legal provisions are more important than others and thereby 
cause legal uncertainty. Additionally, partially quoting provisions can in practice 
lead to interpretation, potentially deviating from the legally binding rules. 


Given that native cloud architecture has evolved to include a range of “as a 
Service” offerings that go beyond “laaS’, “SaaS”, etc., and that the boundaries 
between them are ill-defined, the PRAAS should focus on establishing a single, 
comprehensive basic requirements framework that applies equally to all such 
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services. This could further help customers to compare different cloud services 
offerings more effectively and efficiently. 


It is essential that the PRAAS refers as much as possible to established European 
or international standards, and only when they are recognised as finalised 
standards. If a specific goal can be achieved by complying with various equivalent 
standards, certificates and/or codes of conducts, providers should be able to 
choose how they specifically will meet any compliance requirements, while 
displaying the alternative chosen in the GAIA-X service discovery. Requiring 
adherence to a single selected standard should be avoided unless essential for 
interoperability or portability. In that regard, an exclusive focus in the PRAAS V1.1 
on the CISPE Code of Conduct is inappropriate and contradicts the goal of an open 
and competitive ecosystem. 


Furthermore, we believe that to ensure the sound functioning of the GAIA-X 
ecosystem, it is crucial that any compliance requirements mandated in the PRAAS 
do not require additional membership in other organisations, nor should any 
GAIA-X AISBL member be mandated to provide any GAIA-X-compliant services. 
Conversely, membership of the GAIA-X AISBL should not be required for an 
organisation to be able to offer PRAAS-compliant services in the GAIA-X federated 
ecosystem. 


We understand that GAIA-X wants to identify internationally recognised standards 
guaranteeing data sovereignty, data protection, data portability, information 
security, etc. From this perspective, questions arise about some of the rules 
proposed in the PRAAS V1.1 regarding location of data storage and processing, 
and the applicability of non-European extraterritorial regulation. While we support 
further transparency on the location of data storage and processing, we do not 
think that such requirements should go beyond applicable EU rules. In all 
circumstances, it is important not to create additional confusion for users and 
providers. 


Relationship with data spaces 
Governance of data spaces 


Developing and supporting the data spaces is one of the core objectives of the 
GAIA-X project. In this context, we understand that the GAIA-X AISBL is currently 
working on one or several documents that would outline policy rules for certain 
data spaces. 


Given the importance of the data spaces within GAIA-X, and more generally, as 
future drivers of the European data economy, it is important to ensure ample 
consultation and transparency on documents defining their framework. This would 
allow interested GAIA-X members to have the opportunity to express their views 
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and to provide input and expertise on a topic which will be an important output and 
policy contribution of the association. 


Transparency and inclusion of impacted stakeholders and GAIA-X members in the 
data spaces governance process is important, particularly in relation to the work 
that is also being done in the GAIA-X national hubs. 


In general, we recommend more clarity on the relationship between the GAIA-X 
AISBL, its data spaces and its national hubs. For GAIA-X members who want to 
support and participate in the ecosystem, it is important to understand the 
respective roles and interactions. 


In addition, it is crucial that the GAIA-X data spaces are designed in coordination 
with the Common European data spaces supported by the European Commission. 
Ensuring alignment and avoiding duplication of initiatives is crucial to create fit-for- 
purpose data spaces benefitting the European economy and society. 


All developments — be it for infrastructure, marketplaces or data spaces — should 
be ‘use case oriented’ and satisfy business and societal needs. We recommend 
use cases to be ecosystem-based and (when relevant) cross-sectorial, with 
impact, speed, and value creation as key drivers. 


Technical implementation of data spaces 


GAIA-X strongly builds on the work of the International Data Spaces Association 
(IDSA) for the development of GAIA-X data spaces. More particularly, GAIA-X 
recommends the International Data Spaces standard (IDS), which aims to enable 
open, transparent and self-determined data exchange. We hope that GAIA-X will 
channel the strengths of the IDSA model but also accommodate its limitations. 


In practice it appears that each participant to the International Data Spaces must 
undergo certification by IDSA-approved certification and evaluation facilities. It is 
important that such an arrangement would not affect the adoption of the IDS, 
particularly for smaller businesses. Additionally, it is unclear if, which, and to what 
extent certification requirements would apply to the components of the IDS 
ecosystem and/or participating organisations. 


Questions also arise regarding the compatibility of the unitary static IDSA trust 
model with the interests of many large companies in Europe, which are likely to 
prefer a decentralised trust model where they get to define who provides trust for 
their respective communities. The current proposal for data spaces appears to only 
enable direct peer-to-peer data exchange between two companies and lack a 
design to enable multi-party data spaces. 
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Additionally, the IDSA standards do not specify how to deal with multi-jurisdiction 
scenarios and seem to require IDS participants to develop a separate solution for 
the data stored outside of the EU. This would complicate the efficient operations 
of user companies which operate globally. 


The IDSA standards also do not define any metering and billing, and leave this to 
the participants, which may have negative consequences for smaller companies 
with less negotiation power. 


Finally, it is not entirely clear if the open-source implementation of the IDSA 
connector is free from third-party intellectual property, hence it is not clear how the 
connector can be adopted within GAIA-X. 


FOR MORE INFORMATION, PLEASE CONTACT: 


ùa Julien Chasserieau 


Policy Manager for Data & Innovation 


julien.chasserieau@digitaleurope.org / +32 492 27 13 32 
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About DIGITALEUROPE 


| 
! DIGITALEUROPE represents the digital technology industry in Europe. Our members include l 
l some of the world’s largest IT, telecoms and consumer electronics companies and national l 
| associations from every part of Europe. DIGITALEUROPE wants European businesses and | 
citizens to benefit fully from digital technologies and for Europe to grow, attract and sustain the 
! world’s best digital technology companies. DIGITALEUROPE ensures industry participation in l 
the development and implementation of EU policies. l 

l 


DIGITALEUROPE Membership 


Corporate Members 


Accenture, Airbus, Amazon, AMD, Apple, Arçelik, Atos, Autodesk, Bayer, Bidao, Bosch, Bose, Bristol-Myers 
Squibb, Brother, Canon, Cisco, DATEV, Dell, Dropbox, Eli Lilly and Company, Epson, Ericsson, Facebook, 
Fujitsu, GlaxoSmithKline, Google, Graphcore, Hewlett Packard Enterprise, Hitachi, HP Inc., HSBC, Huawei, 
Intel, Johnson & Johnson, JVC Kenwood Group, Konica Minolta, Kyocera, Lenovo, Lexmark, LG Electronics, 
Mastercard, Microsoft, Mitsubishi Electric Europe, Motorola Solutions, MSD Europe Inc., NEC, NetApp, 
Nokia, Nvidia Ltd., Oki, OPPO, Oracle, Palo Alto Networks, Panasonic Europe, Philips, Pioneer, Qualcomm, 
Red Hat, Ricoh, Roche, Rockwell Automation, Samsung, SAP, SAS, Schneider Electric, Sharp Electronics, 
Siemens, Siemens Healthineers, Sony, Swatch Group, Technicolor, Texas Instruments, Toshiba, TP Vision, 
UnitedHealth Group, Visa, VMware, Workday, Xerox. 


National Trade Associations 


Austria: IOÖ Germany: Bitkom, ZVEI Romania: ANIS 

Belarus: INFOPARK Greece: SEPE Slovakia: ITAS 

Belgium: AGORIA Hungary: IVSZ Slovenia: ICT Association of 
Croatia: Croatian Ireland: Technology Ireland Slovenia at CCIS 

Chamber of Economy Italy: Anitec-Assinform Spain: AMETIC 

Cyprus: CITEA Lithuania: INFOBALT Sweden: Teknikféretagen, 
Denmark: DI Digital, IT Luxembourg: APSI IT&Telekomféretagen 
BRANCHEN, Dansk Erhverv Netherlands: NLdigital, FIAR Switzerland: SWICO 
Estonia: ITL Norway: Abelia Turkey: Digital Turkey Platform, 
Finland: TIF Poland: KIGEIT, PIIT, ZIPSEE ECID 

France: AFNUM, SECIMAVI, Portugal: AGEFE United Kingdom: techUK 
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